Files that are open cannot always be changed. Adversaries know it, so before they encrypt or destroy data they often stop the software that holds it open. T1489, Service Stop, is that step. MITRE files it under impact, with platforms ESXi, IaaS, Linux, macOS and Windows.
How attackers use it
Adversaries may stop or disable services to make them unavailable to users. Stopping critical services or processes can also hinder an incident response or support the adversary's wider goals.
They may target individual services of high importance, such as MSExchangeIS, which would make Exchange content inaccessible. In some cases, they stop many or all services to render systems unusable. Services and processes may not allow changes to their data stores while running, so adversaries stop them to run data destruction or data encryption against databases such as Exchange and SQL Server, or against virtual machines hosted on ESXi.
The cloud has its own version. In AWS, a threat actor can use the DisableAPIServiceAccess API to prevent a service from creating service linked roles in new accounts of an organization.
MITRE's procedure examples are telling. Ransomware families look for and stop database processes, stop services related to backups, terminate named processes before encryption, and stop running virtual machines.
How to detect it
MITRE's detection strategy has an analytic per platform.
- Windows: a privileged process stopping or disabling critical services such as Exchange, SQL, antivirus or endpoint monitoring, using native utilities or APIs. MITRE names sc.exe and the ChangeServiceConfigW API in the behavior chain, with elevated execution before and file changes after.
- Linux: systemctl or service stop commands aimed at high value services such as mysql or sshd, usually run with sudo or su, often followed by deletion or shredding of data stores. Syslog or messages entries and file access are the evidence.
- macOS: launchctl bootout or disable commands, or termination of critical background processes such as securityd, from a terminal or remote shell, often followed by rm or diskutil.
- ESXi: esxcli or vim-cmd commands that stop VM services or force stop VMs. Audit logs of privileged user activity and datastore file manipulation are the evidence.
MITRE does not list event IDs. In practice, forward service control events and process creation with command lines, and write alerts around three rules:
- A security or backup service stopped on a host, by anything other than your management tooling.
- Many services stopped in a short window.
- A database or hypervisor service stopped, followed by large file changes.
The last one is the strongest. It is the pattern of a stop before an impact.
How to reduce the risk
MITRE lists five mitigations.
- Network segmentation. Operate intrusion detection, analysis and response systems on a separate network from production, so an adversary has less chance to see and interfere with response functions.
- User account management. Limit privileges so only authorized administrators can interact with service changes and configuration.
- Out of band communications. Set policies that use communication channels outside the affected environment during an incident.
- Restrict registry permissions. Make sure registry permissions inhibit adversaries from disabling or interfering with critical services.
- Restrict file and directory permissions. Make sure process and file permissions do the same.
The out of band point is easy to overlook. If your chat and email run on the systems being attacked, you need another way to reach each other.
Check your own environment
- List which accounts can stop or disable security and backup services. The list should be short.
- Confirm that tamper protection is on for your endpoint security software, if it supports it.
- Confirm that a stopped security service raises an alert somewhere a local administrator cannot silence.
- Write down your out of band contact method and test that people have it.
- On ESXi hosts, confirm who has shell access, and that logs leave the host.
Quick check
Why do adversaries stop database services before encryption?
Services may not allow changes to their data stores while running, so stopping them lets data destruction or encryption proceed.
Name one platform specific signal MITRE lists.
For example systemctl stop on Linux, launchctl bootout on macOS, sc.exe on Windows, or esxcli and vim-cmd on ESXi.
